Comment 2 for bug 1746444

Note: clients (as example) even fails if called as root.

Path is just not existing, if it exists as:

$ sudo ls -laF /run/chrony
total 0
drwxrwx--- 2 _chrony _chrony 40 Jan 31 08:48 ./

That is:
perm: 770
owner: _chrony:_chrony

Then things work on startup and creates:
srwxr-xr-x 1 _chrony _chrony 0 Jan 31 08:54 /run/chrony/chronyd.sock=

With that if a user that can not access the socket calls chronyc it is as before.
But if a user can (member of chrony group or as root) then it has the designed elevated permissions.

ubuntu@b-test-chrony:~$ sudo chronyc
chrony version 3.2
Copyright (C) 1997-2003, 2007, 2009-2017 Richard P. Curnow and others
chrony comes with ABSOLUTELY NO WARRANTY. This is free software, and
you are welcome to redistribute it under certain conditions. See the
GNU General Public License version 2 for details.

chronyc> clients
Hostname NTP Drop Int IntL Last Cmd Drop Int Last
===============================================================================
localhost 0 0 - - - 2 0 2 5
chronyc> quit